sudo apt-get install gcc-mingw-w64-x86-64git clone https://github.com/Helixo32/CrimsonEDRcd CrimsonEDR;chmod +x compile.sh;./compile.sh{"IOC": [ ["0x03", "0x4c", "0x24", "0x08", "0x45", "0x39", "0xd1", "0x75"], ["0xf1", "0x4c", "0x03", "0x4c", "0x24", "0x08", "0x45", "0x39"], ["0x58", "0x44", "0x8b", "0x40", "0x24", "0x49", "0x01", "0xd0"], ["0x66", "0x41", "0x8b", "0x0c", "0x48", "0x44", "0x8b", "0x40"], ["0x8b", "0x0c", "0x48", "0x44", "0x8b", "0x40", "0x1c", "0x49"], ["0x01", "0xc1", "0x38", "0xe0", "0x75", "0xf1", "0x4c", "0x03"], ["0x24", "0x49", "0x01", "0xd0", "0x66", "0x41", "0x8b", "0x0c"], ["0xe8", "0xcc", "0x00", "0x00", "0x00", "0x41", "0x51", "0x41"] ]}-d <path_to_dll>：指定CrimsonEDR.dll文件的路径；-p <process_id>：指定需要注入DLL的目标进程PID；.CrimsonEDRPanel.exe -d C:TempCrimsonEDR.dll -p 1234
项目地址
原文始发于微信公众号（FreeBuf）：CrimsonEDR：一款恶意软件模式识别与EDR策略评估工具
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论